Article 22
Article 22 – Processing under the authority of the controller and processor
| Member States shall provide that the processor and any person acting under the authority of the controller or of the processor, who has access to personal data, may only process them on instructions from the controller or where required by Union or Member State law. |

